The vulnerability is a heap-based buffer overflow (CWE-122) that resides in the processTile() function of the unc_decoder_mixed_interleave component of libheif versions 1.18.0 up to 1.23.2. By supplying HEIF files with chroma components that have unequal bit depths—such as a 16‑bit Cb plane and an 8‑bit Cr plane—an attacker can trigger an out‑of‑bounds write that extends beyond the Cr plane. If this write falls on executable memory, it enables the attacker to execute code within any process that loads libheif to decode the malicious file.

The issue affects all applications that link to libheif from strukturag version 1.18.0 through 1.23.2, including media players, image editors, and server‑side services that process HEIF images.

The CVSS score of 7.7 indicates high severity. Because the vulnerability causes a heap buffer overflow (CWE-122), the required condition for exploitation is the ability to supply a crafted HEIF file to a vulnerable instance of libheif. Based on the description, the likely attack vector is local or remote file ingestion; the attack may be triggered by any user able to provide the image to the processing pipeline. The EPSS score is unavailable and the vulnerability is not currently listed in the CISA KEV catalog, which does not diminish the potential impact for affected deployments.